HP-UX NIS login problem while using LDAP passwd

[CathyHan]

I have a NIS client on HP-UX 11.11 and the NIS server is on another Linux server.After i configured the NIS sucessfully(ypwhich can return the right value), i found there are some problems with the nis account which using LDAP to manage the password.

Those account can not login to this server(receiving "Access Denied" when login) while some of the users which are created directly on nis server can login. For example:

bash-3.2# ypcat passwd|grep cathy
cathy:LDAP:10259:2230:Name=Han Loli,id=10259,sitecode=CNCHEAB:/home/cathy:/bin/bash

bash-3.2# ypcat passwd|grep ccvobadm
ccvobadm:rtg-jFVsIJKSkHhQ:31000:300:ClearCase Vob Administrator:/home/ccvobadm:/bin/bash

The user cathy can not login while ccvobadm can. is there any body knows why?

Any comments will be highly appreciated. Thank you,

Brs,
Cathy

[Dave Olker]

Hi Cathy,

If I had to guess I'd say it's the second field in the "cathy" user entry. If the NIS entry for this user is literally what you've provided and the string "LDAP" is where your encrypted password is supposed to be, then I would expect you not to be able to log in successfully unless your password somehow magically encrypts to the string "LDAP".

I'm confused about why you're mixing NIS and LDAP in this environment. If you're using LDAP to manage users then you should consider configuring the 11.11 system to use LDAP and stop using NIS for user management.

Regards,

Dave

[CathyHan]

Hi Dave

Thanks for your reply. Actually, the NIS server/LDAP stuffs are configured by some IT guys in our company and i also don't know why they would do it like this. However, there are also several Linux NIS client configured by them which can pass the authentication sucessfully. How can Linux be sucessful in this way?

[Dave Olker]

Hi Cathy,

I think what this comes down to is how your HP-UX system is configured both for name service resolution and for authentication.

Can you provide the passwd entry from the /etc/nsswitch.conf file? That will tell me if LDAP is used for resolving passwd entries or not. The next step would be to look at the PAM configuration to ensure PAMLDAP is being used for authentication.

If LDAP is used for both of those then it shouldn't matter what the NIS map entry looks like because the information would be retrieved from LDAP anyway.

Regards,

Dave